openSUSE-SU-2026:22210-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22210-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22210-1
Upstream
CVE (7)
  • CVE-2026-105481
  • CVE-2026-105482
  • CVE-2026-106069
  • CVE-2026-106072
  • CVE-2026-106073
  • CVE-2026-106074
  • CVE-2026-111497
Related
CVE (7)
  • CVE-2026-105481
  • CVE-2026-105482
  • CVE-2026-106069
  • CVE-2026-106072
  • CVE-2026-106073
  • CVE-2026-106074
  • CVE-2026-111497
Published
2026-10-30T13:44:42Z
Modified
2026-11-04T17:23:22Z
Summary
Security update for nodejs22
Details

This update for nodejs22 fixes the following issues:

  • CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
  • CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
  • CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
  • CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
  • CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
  • CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
  • CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

  • Update to 22.23.4:
  • CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
  • CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
  • CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
  • CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
  • CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
  • CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
  • deps: update c-ares to 1.34.9
  • deps: update timezone to 2026e
  • deps: upgrade openssl sources to openssl-3.5.9
  • deps: update sqlite to 3.53.4
  • deps: update undici to 6.29.1
  • deps: update corepack to 0.36.0
  • deps: upgrade npm to 10.9.9
  • deps: update icu to 78.3
  • node-api: support SharedArrayBuffer in napi_create_typedarray
  • node-api: add napi_create_external_sharedarraybuffer
References

Affected packages

openSUSE:Leap 16.0 / nodejs22

Package

Name
nodejs22
Purl
pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.4-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "corepack22": "22.23.4-160000.1.1",
            "nodejs22": "22.23.4-160000.1.1",
            "nodejs22-devel": "22.23.4-160000.1.1",
            "nodejs22-docs": "22.23.4-160000.1.1",
            "npm22": "22.23.4-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22210-1.json"